Chainalysis attributes $387 million Bitget theft to North Korea

Chainalysis attributed the September 24 theft of $387 million from Bitget to North Korean actors, according to its October 1 investigation report.

The firm said the attack brought crypto thefts linked to North Korea above $1 billion in 2026.

Within three hours, the stolen funds moved in 23 transfers across Ethereum, XRP, Zcash and Tron. Chainalysis put their shares at 49.7%, 40.8%, 7.6% and 1.8%, respectively.

Attackers converted stolen XRP into Bitcoin through a cross-chain liquidity protocol. Investigators matched deposits with payouts and followed tens of millions of dollars to attacker-controlled Bitcoin addresses.

Chainalysis said AI-built automation reduced one bridge-reconciliation task from more than 20 hours to under 10 minutes. Human investigators reviewed outputs and directed the work.

The firm said it would continue monitoring destination addresses and sharing information with exchanges and law enforcement.